Enterprise security teams have spent years hardening email, endpoints, and web applications.
Voice often gets less scrutiny, even though it’s still a live, high-trust channel into the business. It’s where customers verify their identity, make payments, and change account details, often in a single conversation.
That gap is getting harder to ignore as contact centers connect voice to more APIs and give AI voice agents the authority to act on a caller’s behalf. In many of those calls, no one is monitoring the conversation as it happens, so a fraudulent caller may be dealing only with software. In AVOXI’s 2026 State of International Voice Report, voice interception and eavesdropping (38%) and insecure VoIP API integrations (36%) were the two most-cited security concerns. Both ranked ahead of robocalls, caller ID spoofing, and deepfake voice attacks.
Those findings point to a broader shift. Voice security risks now go beyond familiar threats like fraud and caller impersonation. They also include the infrastructure, integrations, and data that support enterprise voice.
Why Voice Security Needs a Broader Risk Model
Voice rarely has a single owner. IT manages the infrastructure and carrier relationships. Contact center operations run the interactions and workflows, and usually the AI voice agents that now handle part of that work, though some organizations give those agents to a separate CX, digital, or AI team. Security sets policy across the organization. Each group sees part of the voice environment, so ownership and oversight are less clear, and gaps can form where responsibilities meet.
Legacy assumptions add to the problem. Voice has long been treated as a trusted, harder-to-attack channel, so it often hasn’t received the same scrutiny as digital systems. That assumption is harder to defend as the channel changes.
AI and cloud adoption are connecting voice to more applications, APIs, and systems. AI voice agents are also taking on higher-stakes tasks. According to AVOXI’s research, 81% of organizations using AI voice agents apply them to authentication and identity verification. Each interaction can depend on connections between the voice platform and CRMs, AI platforms, payment systems, and other applications.
As these environments become more complex, organizations need to consider two kinds of risk: threats that come through the voice channel, such as fraudulent or impersonated callers, and risks within the infrastructure that supports it, including the networks, integrations, and stored data behind each call.
The Threat Landscape: What Is Hitting Contact Centers
Voice interception and eavesdropping
Voice interception was the most-cited concern in AVOXI’s research, named by 38% of organizations as one of their top three security challenges. It reflects the risk of unauthorized access to voice communications as calls move across networks and through the systems that handle them.
Real-world example: In November 2024, the FBI and CISA reported that PRC-affiliated actors had compromised commercial telecommunications infrastructure in the U.S. The breach included theft of customer call records data and compromise of the private communications of a limited number of individuals. The campaign, widely reported as Salt Typhoon, showed that carrier networks themselves can be exposed.
Insecure VoIP API integrations
APIs connect voice with CCaaS platforms, CRMs, AI voice agents, analytics tools, and other applications. Each connection can carry call data, customer information, or control over call routing. A weakness in any one of them can expose that data or give an attacker a way in.
This concern ranked second overall (36%), but it was far more common at the largest organizations. In AVOXI’s research, 78% of organizations with more than 10,000 employees named insecure VoIP API integrations as their top security concern. Among organizations with 1,000–2,500 employees, the figure was 21%. The difference likely reflects how many more integrations, countries, and systems large enterprises have to secure.
Real-world example: In 2023, a critical SQL injection vulnerability was discovered in 3CX’s CRM integration. The flaw could let attackers manipulate database queries through the integration, potentially exposing sensitive data without intercepting a call.
Telephony denial-of-service (TDoS) attacks
TDoS attacks flood voice systems with calls to overwhelm them and disrupt availability. For a contact center, that can mean real customers can’t get through and agents are tied up with calls that go nowhere. TDoS was the third most-cited concern in AVOXI’s research (35%).
Real-world example: On August 4, 2024, a TDoS attack disrupted 911 call centers across Central Texas. The Capital Area Council of Governments (CAPCOG), which supports 911 call processing for the region, said the attack hit call centers in at least seven of its 10 counties and affected 21 law enforcement and first-response agencies. According to CAPCOG board minutes, the City of Austin’s 911 calls more than tripled, and calls to Round Rock and the Travis County Sheriff’s Office rose by more than 1,000%. Normal operations didn’t return until about 8 p.m., roughly seven hours after the problem was first reported.
Most documented TDoS cases involve public safety lines, because enterprises rarely disclose them. But the Department of Homeland Security has warned that the same tactic could be used against financial services organizations to keep customers from reaching their banks.
Robocalls and caller ID spoofing
Robocalls and spoofed calls misuse caller identity in two main ways:
- Fraudsters spoof a trusted number to get past an agent’s guard.
- Fraudsters spoof an enterprise’s own numbers to target its customers.
Both disrupt legitimate voice traffic, and the second can damage trust in a company’s real calls. In AVOXI’s research, having caller ID flagged as scam or spam was tied as the top obstacle to outbound connect rates (57%).
In AVOXI’s research, 33% of organizations named robocalls and spoofing as a top-three concern. When organizations rated operational severity, though, these threats ranked highest, with 35% rating them high-risk.
Real-world example: In November 2022, an international operation led by London’s Metropolitan Police and coordinated by Europol shut down iSpoof, a paid service that let fraudsters disguise their calls as coming from banks, tax offices, and other trusted organizations. Callers posed as banks such as Barclays, HSBC, and Santander, warned customers about suspicious account activity, and talked them into handing over security details and one-time passcodes. More than 200,000 people in the UK were targeted, and confirmed UK losses reached £43 million. The site’s administrator was sentenced to more than 13 years in prison.
iSpoof is the second risk in practice: fraudsters used real banks’ identities to reach those banks’ customers. Every successful call also makes the next genuine call from that bank easier to doubt. Branded caller ID is one way enterprises are responding. It shows a business’s verified name, logo, and reason for calling on the recipient’s phone, which can help customers recognize calls that really come from the company. Full branded caller ID is still available only in limited markets, such as the United States, and in limited scenarios.
Synthetic and AI-generated voice fraud
Deepfake and cloned-voice attacks target both IVR systems and live agents. A cloned voice can pass voice-based verification or convince an agent that a caller is who they claim to be. In AVOXI’s research, 33% of organizations named deepfake or synthetic voice attacks as a top-three concern.
Real-world example: In 2019, fraudsters used AI-generated audio to impersonate the CEO of a German company and convince the head of its UK subsidiary to transfer $243,000 to a fraudulent account. The executive reportedly recognized his boss’s German accent and voice patterns and believed the request was legitimate. The attackers later attempted a second transfer, which the executive refused.
Data exposure in call recordings and storage
Call recordings and transcripts can hold payment details, account information, and answers to security questions. Compliance rules govern much of how that data is handled, but security raises separate questions: who can access recorded calls, where they’re stored, and how they’re protected. As AI adds transcripts and summaries to more interactions, that data can end up in more places.
Real-world example: In 2026, security researcher Jeremiah Fowler found three publicly accessible databases containing 3.7 million records tied to Sears Home Services’ AI customer support assistant. The exposed data included audio recordings and transcripts of customer calls, along with names, phone numbers, home addresses, and service details.
Exposed audio adds another risk. Recordings of customers and agents can give attackers source material for cloning their voices, which links this threat to the synthetic voice fraud described above.
Building a Risk-Based Approach to Voice Security
A practical starting point is to assess the security technology you already have and understand which threats it can and can’t detect and stop. Most organizations already have some voice security in place. AVOXI’s research found that organizations buy it from several sources:
- Third-party security vendors (60%)
- Network APIs for identity and authentication (59%)
- Native CCaaS security features (58%)
The more useful question is where those tools leave gaps against the threats above.
Layer security across the environment
No single control or technology covers every voice threat. A layered approach addresses identity and access, network security, data protection, and monitoring and response together. That matches how most organizations in AVOXI’s research already defend against voice threats: they combine technical and procedural measures rather than relying on either alone. The layers only work if, together, they cover the whole environment.
Match authentication to the risk
Not every call carries the same risk. A balance inquiry and a request to change the phone number on an account don’t necessarily need the same verification. Higher-risk interactions may call for stronger authentication or extra verification, while lower-risk calls can move through with less friction.
“I think we need to really start looking at authentication, not as a black-and-white yes and no, but as a continuum of probability,” AVOXI CTO Randy Layman told CX Today.
Voice biometrics can be one layer in that approach. It uses characteristics of a caller’s voice to help verify identity alongside other authentication signals. It’s also on many roadmaps: 52% of organizations in AVOXI’s research named voice biometrics as an AI voice priority for the next 12 to 18 months. But synthetic and cloned voices are becoming more sophisticated, so biometrics should be part of a broader risk-based authentication strategy rather than a standalone answer to voice fraud.
Biometrics also bring their own privacy and compliance obligations. A voiceprint is biometric data. The EU’s GDPR treats biometric data used to identify a person as a special category of personal data, and U.S. laws such as Illinois’ Biometric Information Privacy Act (BIPA) set consent, retention, and disclosure rules for voiceprints. Regulation may already be shaping adoption: in AVOXI’s research, interest in voice biometrics was much higher in APAC (64%) than in Europe (39%). Any biometrics program needs a clear plan for how voiceprints are collected, stored, retained, and accessed.
Monitor for behavior that signals risk
Anomaly detection and other monitoring can flag unusual calling patterns, access behavior, and potential fraud. Examples include sudden spikes in call volume, repeated failed verification attempts, and administrative logins from unexpected locations. Monitoring shows how callers and users behave over time, which a single verification check can’t.
Protect the infrastructure behind the call
Many of the top concerns in AVOXI’s research involve systems behind the call rather than the conversation itself. Securing voice means protecting voice traffic, APIs, recordings, administrative access, and the systems connected to the voice environment. That work deserves the same discipline as any other critical infrastructure.
Build security into provider selection
Voice providers shape much of an organization’s security posture, so security should be part of your evaluation. Assess providers on:
- Security architecture
- Data protection practices
- Compliance support
- Threat detection
- Incident response capabilities
Independent audits can shorten that review. A SOC 2 report or ISO/IEC 27001 certification shows that a third party has assessed a provider’s controls, which gives you evidence on several of these areas without running a full assessment yourself. Check the report’s scope and date, then focus your own review on what it doesn’t cover.
Buyers already weigh this heavily. In AVOXI’s research, security and compliance was the highest-rated factor in choosing an AI voice vendor (6.26 out of 7).
For a deeper look at what to evaluate, see Security Theater vs. Real Voice Security: What Enterprises Actually Need to Protect.
Closing the Gap: What Your Voice Security Review Should Cover
A voice security review should give every team with a stake in voice a shared view of where the risk is. Use these questions as a starting point:
- Voice traffic and interception: Where could voice communications be exposed, and how are they protected?
- APIs and integrations: Which applications and platforms connect to your voice environment, and how is each connection secured?
- Availability: How is business-critical voice protected against TDoS and other disruptions?
- Identity and authentication: How is caller identity verified? Where could voice biometrics or additional authentication signals strengthen verification? How are spoofing, impersonation, and synthetic voice threats managed?
- Voice data and recordings: Where are recordings, transcripts, and voiceprints stored, who can access them, and how is that access controlled?
- Monitoring and ownership: Who owns voice security, including AI voice agents, and do they have the visibility they need to identify and respond to risk?
Securing Voice Means Seeing the Whole Picture
Voice security now means looking at the entire environment. That includes the infrastructure carrying each interaction, the systems it connects to, and the methods used to establish caller trust. Layered controls work when, together, they cover all of it. A strong authentication layer still leaves exposure if an API connection or a store of call recordings goes unprotected.
AI is changing both how contact centers operate and the threats they face. Organizations will need to keep reassessing where risk exists and whether their security controls still match it.
How well do you know your voice environment?
AVOXI helps enterprises manage global voice infrastructure with the visibility, control, and intelligence needed to support secure, reliable communications across markets.
You Might Also Be Interested in
Your AI Stack Is Only as Good as Your Voice Layer: A Guide for IT Directors
Need Help Getting US Phone Numbers?
We're here to help! Contact us today so we can help find the right business phone number for you.